[1]} first demonstrated that a highly accurate deep neural network can be mislead to make a misclassification by adding a slight perturbation to an image that is imperceptible to the human eye, and also found that the robustness of deep neural networks can be improved by adversarial training.
Such phenomena are far-reaching and have attracted many researchers in the area of adversarial attacks and deep learning security.
[2]} surveyed 12 attack methods and 15 defense methods for neural networks adversarial attacks.
The main attack methods are finding the minimum loss function additive term [1]}, increasing the loss function of the classifier [4]}, the method of limiting the l_0 norm [5]}, changing only one pixel value [6]}, etc.
